CVE-2026-12189

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-12189
A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://drive.google.com/file/d/1lKtJX8mhbGTiMarv2H3psd9iombJ-dIn/view?usp=sharing
https://github.com/honestcorrupt/MOOVIT-CVE-.git
https://vuldb.com/cve/CVE-2026-12189
https://vuldb.com/submit/824449
https://vuldb.com/vuln/370835
https://vuldb.com/vuln/370835/cti
https://github.com/honestcorrupt/MOOVIT-CVE-.git
https://vuldb.com/submit/824449
Configurations

No configuration.

History

23 Jul 2026, 11:10

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una falla en la aplicación Moovit Bus & Public Transit App 1.18 en Android. Esto afecta a una parte desconocida del componente com.tranzmate. Ejecutar una manipulación puede llevar a una autorización indebida en el gestor para el esquema de URL personalizado. El ataque solo puede ejecutarse localmente. El exploit ha sido publicado y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgación, pero no respondió de ninguna manera.

15 Jun 2026, 16:16

Type Values Removed Values Added
References () https://github.com/honestcorrupt/MOOVIT-CVE-.git - () https://github.com/honestcorrupt/MOOVIT-CVE-.git -
References () https://vuldb.com/submit/824449 - () https://vuldb.com/submit/824449 -

14 Jun 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-14 23:16

Updated : 2026-07-24 12:10

NVD link : CVE-2026-12189

Mitre link : CVE-2026-12189

CVE.ORG link : CVE-2026-12189

JSON object : View

Products Affected

No product.

CWE
CWE-285

Improper Authorization

CWE-939

Improper Authorization in Handler for Custom URL Scheme